Fake LastPass Authenticator Installer Leverages Microsoft‑Signed Driver to Neutralize Security Software

Fake LastPass Authenticator Installer Exploits Microsoft‑Signed Driver

A counterfeit LastPass Authenticator installer circulating on GitHub drops a Windows kernel driver that disables antivirus, endpoint detection and response (EDR) tools before unleashing a password‑stealing payload. Researchers at LastPass and Delphos Labs observed the driver bears a legitimate Microsoft hardware‑compatibility signature, allowing it to bypass Windows driver enforcement. VirusTotal logged ↓ 0 detections at the time of analysis, a stark illustration of trust abuse. Once the driver is loaded, security suites are silently terminated, leaving the system exposed. ‘The attacker’s playbook is simple: neutralize defenses, then harvest credentials,’ said a security analyst in a

private briefing

. The malicious installer masquerades as a legitimate update, prompting users to download and execute it. Microsoft’s signing program, intended for genuine hardware drivers, is being weaponized, raising questions about the vetting process for kernel‑mode code. Reuters reported a surge in similar supply‑chain tricks this year, while Bloomberg highlighted the growing market for signed driver malware. Organizations are urged to enforce strict code‑signing policies and monitor kernel activity. The episode also echoes broader security challenges that have emerged in the wake of the pandemic, when remote work expanded the attack surface.

Reported by: Nova Stirling

Aerospace & Space Tech Correspondent